Grafana OSS: Stored XSS via external Alertmanager generatorURL

An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL . The attacker is authorized to create the alert, but not to execute script in another user’s Grafana session. Grafana renders...

CVE-2026-5388

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...

CVE-2026-5388 justhtml before 1.15.0 Multiple Security Issues

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...

EUVD-2026-64652

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...

CVE-2026-5388

justhtml (Python HTML sanitizer library) before 1.15.0 contains multiple sanitization bypass vulnerabilities across URL sanitization helpers, HTML serialization, Markdown passthrough, and custom policy edge cases. Attackers can inject active HTML and JavaScript via vectors such as encoded javascr...

CVE-2026-5388 justhtml before 1.15.0 Multiple Security Issues

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...

CVE-2026-77116

Brave Popup Builder (WordPress plugin, slug: brave-popup-builder) versions through 0.8.5 contain a broken access control vulnerability. Any authenticated user with a low-privilege role (Subscriber or WooCommerce Customer) can read unpublished popup content by passing a post ID in the URL, effecti...

OSV-2026-1189 Global-buffer-overflow in oidc_cfg_redirect_urls_allowed_get

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=550474749 Crash type: Global-buffer-overflow READ 8 Crash state: oidccfgredirecturlsallowedget oidcvalidateredirecturl fuzzurl.c...

PT-2026-79769

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers clean url value/clean url in js string, HTML serialization, Markdown passthrough html passthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass...

Server-side Request Forgery (SSRF)

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the validatenetworkurl DNS resolution path in nltk/pathsec.py. An attacker can make urlopen reach restrict...

Security Bulletin: IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control (CVE-2026-9762)

Summary IBM® Db2® is vulnerable to remote code execution when jdbc url is under user control. Vulnerability Details CVEID:CVE-2026-9762 DESCRIPTION: IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control. CWE:CWE-94:...

CVE-2026-63311

NLTK before 3.10.0 affected versions = 3.9.4 contains a server-side request forgery SSRF vulnerability in the validatenetworkurl function in nltk/pathsec.py. The resolvehostname helper catches OSError and ValueError during socket.getaddrinfo and returns an empty list; when DNS resolution fails, t...

CVE-2026-63311

NLTK before 3.10.0 affected versions = 3.9.4 contains a server-side request forgery SSRF vulnerability in the validatenetworkurl function in nltk/pathsec.py. The resolvehostname helper catches OSError and ValueError during socket.getaddrinfo and returns an empty list; when DNS resolution fails, t...

CVE-2026-65915

NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load to read arbitrary files accessible to the...

UBUNTU-CVE-2026-65915

NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load to read arbitrary files accessible to the...

CVE-2026-65915

NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open() where the sandbox validation check compares a normalized path against itself, rendering the security check permanently inert. An attacker with low privileges can pass file:// URLs to nltk.data.load() to read arbitrary...

CVE-2026-65915 NLTK before 3.10.0 Arbitrary File Read via FileSystemPathPointer

NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load to read arbitrary files accessible to the...

CVE-2026-63311 NLTK before 3.10.0 SSRF via DNS Resolution Failure

NLTK before 3.10.0 affected versions = 3.9.4 contains a server-side request forgery SSRF vulnerability in the validatenetworkurl function in nltk/pathsec.py. The resolvehostname helper catches OSError and ValueError during socket.getaddrinfo and returns an empty list; when DNS resolution fails, t...

CVE-2026-63311 NLTK before 3.10.0 SSRF via DNS Resolution Failure

NLTK before 3.10.0 affected versions = 3.9.4 contains a server-side request forgery SSRF vulnerability in the validatenetworkurl function in nltk/pathsec.py. The resolvehostname helper catches OSError and ValueError during socket.getaddrinfo and returns an empty list; when DNS resolution fails, t...

CVE-2026-59809

SiYuan before v3.8.0 interpolates secret placeholders into the destination URL parameter of the httprequest MCP tool, allowing attackers to exfiltrate stored secrets. An MCP client can craft a request with an attacker-controlled URL containing secret placeholders to send plaintext secret values t...